CVE-2026-49140

Name of the Vulnerable Software and Affected Versions Nanobot versions prior to 0.2.1

Description A denial of service issue exists in the Matrix channel media download handler. Authenticated room members can exhaust process memory and bandwidth by sending media events that lack or contain invalid size metadata. By sending multiple concurrent Matrix media events with omitted or invalid declared sizes, an attacker can trigger simultaneous large media downloads. These downloads fully materialize response bodies before they are rejected post-download, consuming system resources until service degradation occurs.

Recommendations Update Nanobot to version 0.2.1 or later.